Hackers have successfully leveraged a Border Gateway Protocol (BGP) hijacking attack to deliver malicious updates to **Virtualizor**, a widely used VPS management software developed by **Softaculous**. The incident, which occurred between 20:57 UTC on August 28 and 06:10 UTC on August 30, involved the rerouting of a block of **Hetzner**-hosted IP addresses. This allowed the threat actor to divert traffic intended for **Softaculous**'s software update systems and its client/billing portal. BGP hijacking is a serious network-level attack where a malicious entity falsely announces ownership of IP address ranges belonging to another organization. Other networks may then accept this fraudulent route as legitimate, directing traffic to the attacker's infrastructure. ### Malicious Updates Delivered **Softaculous** confirmed that the BGP hijacking enabled attackers to push a malicious **Virtualizor** update package to a "small number of installations" that checked for updates during the compromised period. The vendor noted that this affected a "handful of servers rather than the general **Virtualizor** user base." Due to the nature of the attack, where requests were redirected to the attacker's servers, **Softaculous** does not possess logs of the compromised systems. Consequently, the company has issued urgent recommendations for **Virtualizor** operators. ### Recommended Actions for Admins and Users **Virtualizor** administrators are advised to check their systems for the presence of a suspicious service file: `/etc/systemd/system/java-jre-update.service` If this file is found, immediate action is required. Admins should: * Rotate and restrict API credentials. * Audit systems for unauthorized SSH keys, accounts, scheduled tasks, and outbound connections. Furthermore, users who accessed the **Softaculous** client area or entered payment information during the incident window (August 28, 20:57 UTC to August 30, 06:10 UTC) are strongly urged to: * Reset their passwords. * Review account activity for any suspicious actions. * Monitor credit card statements for unauthorized transactions. ### Post-Incident Measures and Future Security **Softaculous**'s investigation is ongoing, but there are currently no indications that any of its other products were impacted. The company has confirmed that routing has been restored, and the fraudulent certificate used by the attackers has been reported for revocation. In response to the incident, **Softaculous** has released **Virtualizor** version **3.2.9.9**, which includes a new "Security Analyzer" tool in the admin panel. Looking ahead, the company plans to implement cryptographic signing for all software packages and migrate to more robust infrastructure to prevent similar incidents in the future.